Supported Upgrade Paths for FortiOS Firmware VERSION

Transcription

1 Supported Upgrade Paths for FortiOS Firmware VERSION

2 FORTINET DOCUMENT LIBRARY FORTINET VIDEO GUIDE FORTINET BLOG CUSTOMER SERVICE & SUPPORT FORTIGATE COOKBOOK FORTINET TRAINING SERVICES FORTIGUARD CENTER END USER LICENSE AGREEMENT FEEDBACK Tuesday, January 27, 2015 Supported Upgrade Paths for FortiOS Firmware

3 TABLE OF CONTENTS Change Log 4 Overview 5 Purpose of this Document 5 Scope of the Document 5 Location of Upgrade Path documents for other products 5 Product compatibility 6 Source Information 6 Using the Upgrade Steps Table 7 Release numbers 7 Build Numbers 7 Max Value Issue 7 Standalone vs. HA configuration upgrades 8 Parallel Development 8 Upgrade Methods 8 Upgrading from the Local Drive 8 Upgrading from the FortiGuard Network 9 Upgrade Steps Table 10 Potential Issues 18 Special Builds 18 Why read the Release Notes? 18 Sampling of issues 18 Changing of Category Numbers 18 HA Virtual MAC Address Changes 18 Changing of Logging Settings 19 Familiar features removed or changed 19

4 Change Log Date Change Description Updated to include Updated to include New document template

5 Overview Purpose of this Document The goal of this document is to make it easier for you to upgrade your FortiGate unit by guiding you to the most likely intermediate firmware upgrades between your current version and the latest version of the firmware.the latest version being the one with the highest patch number in this version branch. Every time you perform an upgrade to the firmware you should carefully read the release notes of the firmware you are upgrading to. Release notes may include warnings or notices of exceptions. The release notes can be found on the support site in the same directory as the firmware. The Fortinet Support Site can be found at: For most devices these steps will show the path in steps from your current version to the latest Version, MR, and patch. The steps shown by the Upgrade Steps Table are not the only possible path, but they are supported and have been optimized to achieve the latest version of the firmware in the fewest steps. Some older FortiGate hardware platforms do not have the resources to effectively use the most recent firmware versions and so do not support firmware updates past a certain version. To see if your device is affected by this check the Product Life Cycle page found at: Scope of the Document The scope of this document is limited to recommended upgrade practices for the FortiOS firmware, which is used as the Operating System for the following products: FortiGate FortiWiFi FortiCarrier This document does not include the upgrade paths for other Fortinet products such as: FortiManager FortiAnalyzer. These products have their own upgrade path documentation. Location of Upgrade Path documents for other products Other upgrade path documents are available for the following products: FortiAnalyzer FortiManager 5 Supported Upgrade Paths for FortiOS 5.0

6 Source Information Overview These documents are available from the Fortinet Customer Service & Support Site, found at in the same directory as the firmware images and Release Notes. Example links to Upgrade Guides: ftp://support.fortinet.com/fortimanager/v5.00/5.0/5.0.9/fortimanager-v5.0.9-upgrade-guide.pdf ftp://support.fortinet.com/fortianalyzer/v5.00/5.0/5.0.9/fortianalyzer-v5.0.9-upgrade-guide.pdf The above links are examples only, as each firmware release for these products has its own document. Product compatibility This document does not include any references to release compatibility between Fortinet products. This is an issue that administrators of environments where different Fortinet products are used should be aware of. For instance, a specific version of FortiManager has a range of versions of FortiGate that it will be compatible with. If the FortiGates are upgraded without verifying that the FortiManager will be compatible with them, a situation could arise where the FortiManager will not be able to manage those newly upgraded FortiGates. On the other side of the equation, it is also possible to upgrade a FortiManager beyond the compatibility range of some of the older models of FortiGate. If you have some older models of FortiGate that cannot be upgraded to current releases of firmware, and some brand new models of FortiGate that cannot run older firmware, the situation can arise where a single FortiManager will not be able to manage all of the FortiGates in the environment.this is an issue that the administrator needs to be aware of when making decisions about which firmware to run. The compatibility between models is listed in the Release Notes of the products. These should be read and the environment should be planned out as a whole. It is possible that there is no one best option. The administrator will have to weigh the pros and cons of all of the variables and keep in mind what the most important requirements are for the environment. Source Information The source material for the development of the of the upgrade path table is the upgrade information section found in the Release Notes that are written up for each new build of the FortiOS firmware. Each time a firmware build comes out it is tested for compatibility with some of the previous builds in both the current version and the version that preceded it. It is not, however necessarily tested with every single build in these two versions. The two, sometimes 3, versions that are supported at the time of release are developed in parallel and not in coordinated schedules so it is possible that the latest build in version 5 was developed long after a lower numbered build in version 5.2. In short, the upgrade testing is done against build that are available at the time of release. The upgrade steps may at times seem like they should be able to make larger jumps, but we will only included upgrade steps that have been tested and proven to work in those tests. The FortiOS Upgrade path document is initially based on the contents of the Release Notes documents for the firmware, however, periodically, bugs or unexpected combinations of configurations are found the reveal situations that the regular compatibility testing did not account for. These updates are incorporated into the Upgrade path document sometimes without being included into rewrites of the Release Notes. While the paths set forth in the Release Notes will work most of the time for most configurations. It is best to treat the upgrade path document as the safer and more correct source. Supported Upgrade Paths for FortiOS 5.0 6

7 Overview Using the Upgrade Steps Table Using the Upgrade Steps Table We have tried to make using the table as simple as possible. 1. Determine which release is currently running on your FortiGate. 2. Find that release/build in the left hand column. 3. Upgrade from one release to the next based on the releases listed in that row. Release numbers Over the life of the firmware, the designation of the individual releases has changed but this document tries to make these designations as consistent and as easy to understand as possible. Originally, the version designation was made up of a Version, possibly a major release within that version and possible a patch number within that major release. If one was trying to refer to one of the later patches in a later release of version 4 of the firmware it could be described as Version 4 MR 3 Patch 18. To make writing the release name simpler a 'shorthand' developed using the pattern x.x.x. The numbers shown in the table below are an abbreviated form of the firmware version names. 1st Number 2nd Number 3rd Number Version Number MR Number Patch Number Example: = Version 3.0 MR7 Patch 10 Recently, the longer version of describing the release was dropped in favor of the simplified format.so it is not FortiOS Version 5 MR 2 Patch 1. It is simply FortiOS Within the table, the simplified version is always used when describing the path. Build Numbers In cases where there is no indication in the Web-based Manager what the version or build number is you can get the build number from the CLI by entering the command: get system status The value in the output of the command for Branch point will be the build number. Max Value Issue There is a range of builds where the maximum number of some of the objects was lowered, but then a few builds later was raised back up. If a configuration on a device was to have a number of these objects in excess of the lower value when doing an upgrade there could be issues and even data loss so the upgrade paths listed are designed to avoid 7 Supported Upgrade Paths for FortiOS 5.0

8 Standalone vs. HA configuration upgrades Overview upgrading into this lower max value range even though the Release Notes state that upgrading to these firmware builds is supported. When the release notes were written the act of increasing the values was not foreseen. Standalone vs. HA configuration upgrades If you read the Release Notes for the firmware upgrades you will notice a discrepancy between what the Release Notes say is possible for upgrades and what the Upgrade Steps Table shows. In version 5 there is a difference in the steps between the patches depending on whether your FortiGate setup is in a standalone or an HA configuration. If you have a standalone setup you can upgrade from Patch 3 (5.0.3) directly to Patch 5 (5.0.5). However, if you are using an HA setup you need to add the intermediate step of going to Patch 4 (5.0.4), otherwise only the slave unit in the configuration will be upgraded to Patch 5. In the table describing the steps in progressing through the upgrades the most cautious path is listed. This minimizes the possibility of confusion for somebody who has an HA cluster but reads the Release Notes, like everybody should, but was unaware of the known issue with the HA clusters. Parallel Development Development of the firmware is usually taking place on two paths at the same time.there is development taking place on the latest path, as well as the previous stable path. For instance if the latest path was 5.0.x then the previous stable path that would still be in development would be 4.3.x. This has 2 significant ramifications as far as upgrades are concerned. The first is that patches are still being built for each of these paths. The second is that because this development is taking place in parallel the number identifiers for the builds do not correspond directly with the sequence in which the builds come out. An example of this, can be demonstrated by the fact that while version definitely came after 4.3.0, was released after This is the reason that one FortiGate can upgrade directly from to while a different FortiGate starting at needs to go through some intermediate steps to get to the same Upgrade Methods There are two methods of primary methods of upgrading the firmware through the GUI; either from a local file that has been previously downloaded or from the FortiGuard Network. Upgrading from the Local Drive When uploading the firmware from the local drive you must already have downloaded it from the Fortinet Support Site at Once you have logged in with the account ID and password that was created when registering the FortiGate, go to the Download section and select the icon for Firmware images. From there it is only a matter of selecting a product, such as a FortiGate and then selecting either HTTPS or FTP download. The layout of the firmware listing in both methods is a hierarchical tree. For instance if you wanted firmware you would select the v5.00 directory, then the 5.0 directory, then the directory. Once in the directory scroll down until find the correct firmware file name for your specific model. The select the file you wish to download. Supported Upgrade Paths for FortiOS 5.0 8

9 Overview Upgrade Methods The file names are intended to be helpful in determining the correct firmware for the model you need. Here are some of the conventions found in the file names. FGT_ = FortiGate FWF_ = FortiWiFi POE = Power over Ethernet VM32/VM64 = Virtual Machine versions of the firmware. The 32 and 64 referring to the bit architecture of the OS. Firmware going directly on a Fortinet Device will have the.out extension. Upgrading from the FortiGuard Network The practice of strategically skipping some firmware versions to optimize the time and efficiency that it takes to get to the latest version is based on using the Upgrade from: Local Hard Drive option. If you try to use the Upgrade from: FortiGuard Network option you will notice that there are a limited number of firmware builds to which you may upgrade, or downgrade. This is because only options that are always going to be safe are available. The logic being that because there are no intermediate options possible, the next consecutive build will always be a safe option. Because of this limitation in options, it means that you will not be able to use the Upgrade from: FortiGuard Network option to see all of the safe upgrade options. You will either have to use the included upgrade path table or study the Release Notes. The builds that will be shown will most like be as follows: For Upgrades: The next build in the current version track For Downgrades: The previous build in the current version track. The latest build in the previous version track. 9 Supported Upgrade Paths for FortiOS 5.0

10 Upgrade Methods Upgrade Steps Table Upgrade Steps Table Starting Version Supported Steps to Latest Build of Latest Build Patch Patch Patch Patch Patch Patch Patch Patch Patch End of Support Date for Version = March 19, 2014 (unless device does not support FortiOS version 5.0) patch patch Supported Upgrade Paths for FortiOS

11 Upgrade Steps Table Upgrade Methods Starting Version Supported Steps to Latest Build of 5.0 patch patch patch patch patch patch patch patch patch patch patch patch patch patch patch patch Supported Upgrade Paths for FortiOS 5.0

12 Upgrade Methods Upgrade Steps Table Starting Version Supported Steps to Latest Build of 5.0 End of Support Date for Version = April 1, 2013 patch patch patch patch patch patch patch patch patch patch patch patch patch patch patch End of Support Date for Version 4.0 MR1 = August 24, 2012 Supported Upgrade Paths for FortiOS

13 Upgrade Steps Table Upgrade Methods Starting Version Supported Steps to Latest Build of MR1 patch MR1 patch MR1 patch MR1 patch MR1 patch MR1 patch MR1 patch MR1 patch MR1 patch MR1 patch MR End of Support Date for Version 4.0 = February 24, patch patch patch patch End of Support Date for Version 3.0 MR7 = July 18, MR7 patch Supported Upgrade Paths for FortiOS 5.0

14 Upgrade Methods Upgrade Steps Table Starting Version Supported Steps to Latest Build of MR7 patch MR7 patch MR7 patch MR7 patch MR7 patch MR7 patch MR7 patch MR7 patch MR7 patch MR End of Support Date for Version 3.0 MR6 = February 4, MR6 patch MR6 patch MR6 patch MR6 patch MR6 patch MR6 patch Supported Upgrade Paths for FortiOS

15 Upgrade Steps Table Upgrade Methods Starting Version Supported Steps to Latest Build of MR End of Support Date for Version 3.0 MR5 = July 3, MR5 patch MR5 patch MR5 patch MR5 patch MR5 patch MR5 patch MR5 patch MR5 559 End of Support Date for Version 3.0 MR4 = December 29, MR4 patch MR4 patch MR4 patch Supported Upgrade Paths for FortiOS 5.0

16 Upgrade Methods Upgrade Steps Table Starting Version Supported Steps to Latest Build of MR4 patch MR4 patch MR4 474 End of Support Date for Version = October 2, 2009 patch patch patch patch patch patch9 413 patch8 411 patch7 410 patch6 406 Supported Upgrade Paths for FortiOS

17 Upgrade Steps Table Upgrade Methods Starting Version Supported Steps to Latest Build of 5.0 patch5 405 patch The versions below are beyond end of support dates 3.0 MR MR unknown X (X <11) unknown unknown Supported Upgrade Paths for FortiOS 5.0

18 Potential Issues Special Builds Every now and then a "Special Build" is created for some specific purpose and some companies will put these into production. These special builds are not part of the normal upgrade path QA process and therefore have a greater risk of variance from what is normally expected in an upgrade. The table of the upgrade path is based on the Release Notes of the regular builds and may not have included testing against every special build as well. If you are running a special build, be even more cautious in upgrading than you would normally be. Why read the Release Notes? Previously in this document, it was recommended that before upgrading from one version of the firmware to a more recent one that the Release Notes be read. To give an indication of how important it is to read the Release Notes we will provide a sampling of some of the possible issues that may have to be dealt with upon upgrading. To offer some clarification on the contents of this sampling, some of these issues were and are unavoidable because of the nature of the configurations of the FortiGate devices and the networks they were in. The reason for reading the Release Notes is to make sure that users are prepared for changes or potential outages that may occur so that the affected parties can be forewarned and the issues can be dealt with in a timely manner. Sampling of issues These are some issues, in no particular order, that have been brought to the attention of the Technical Assistance Center or the Documentation Team that could result during the course of a firmware upgrade. Changing of Category Numbers When looking at the FortiGuard Webfilter categories or Application categories in the GUI we see the nice easily understood names that indicate what they refer to but in the code of the firmware these categories are referenced by a integer and not a text string. Periodically the list of categories changes, whether by the number growing larger or smaller it doesn t matter. If the list changes then so do the values of objects in that list. If your policies are everything is wide open you are not likely to see an issue but if there are carefully crafted restrictions in place. HA Virtual MAC Address Changes HA virtual MAC addresses are created for each FortiGate interface based on that interface s index number. Between FortiOS 4.3 and 5.0 interface indexing changed. After upgrading a cluster to FortiOS 5.0 the virtual MAC addresses 18 Supported Upgrade Paths for FortiOS 5.0

19 Sampling of issues Potential Issues assigned to individual FortiGate interfaces may be different. You can use the get hardware nic <interface-name> command to view the virtual MAC address of each FortiGate interface. The practical consequences of this could be seen in a situation where, in a very security conscious environment, there is some blocking or allowed traffic based on mac addresses. When the firewall s mac address is not on the list of allowed addresses any traffic going through the firewall is likely to be problematic. Changing of Logging Settings There was a case where upgrading a few builds too far, in a very specific scenario, changed a logging setting. When going from one of the 4.3 builds to one of the earlier 5.0 builds, VDOM policies that also had IPS profiles had one of the log setting change from logging all traffic to logging only UTM events. The upgrade path works in all other respects; it just a case of having to go through the affected policies and change the setting. Oddly enough, if the upgrade had gone all the way to 5.0.8, the issue would not have occurred. Familiar features removed or changed While not an issue that will potentially stop the FortiGate from working, this issue will sometimes make it worthwhile to keep a close eye on the performance of your FortiGate after an upgrade to make sure everything is still doing what it was before the upgrade. For instance, when upgrading from 4.3 to version 5, the logtraffic-start function is disabled by default. In version 4.3, the extended-traffic-logoption in config log [memory disk fortianalyzer syslog] filter controlled the session start logging. In version 5.0, this is controlled by logtraffic-start in the policy settings. If before the upgrade, the"extended-traffic-log" was enabled, the logtraffic-start in policy settings will be disabled. More often than not this is the default setting of after an upgrade.. While for some users the loss of this function may be inconsequential, to other users this function might be useful. This is another reason to read the Release Notes; checking to verify that features commonly used in your environment will be there after the upgrade. Supported Upgrade Paths for FortiOS

20 Copyright 2015 Fortinet, Inc. All rights reserved. Fortinet, FortiGate, FortiCare and FortiGuard, and certain other marks are registered trademarks of Fortinet, Inc., in the U.S. and other jurisdictions, and other Fortinet names herein may also be registered and/or common law trademarks of Fortinet. All other product or company names may be trademarks of their respective owners. Performance and other metrics contained herein were attained in internal lab tests under ideal conditions, and actual performance and other results may vary. Network variables, different network environments and other conditions may affect performance results. Nothing herein represents any binding commitment by Fortinet, and Fortinet disclaims all warranties, whether express or implied, except to the extent Fortinet enters a binding written contract, signed by Fortinet s General Counsel, with a purchaser that expressly warrants that the identified product will perform according to certain expressly-identified performance metrics and, in such event, only the specific performance metrics expressly identified in such binding written contract shall be binding on Fortinet. For absolute clarity, any such warranty will be limited to performance in the same ideal conditions as in Fortinet s internal lab tests. In no event does Fortinet make any commitment related to future deliverables, features, or development, and circumstances may change such that any forward-looking statements herein are not accurate. Fortinet disclaims in full any covenants, representations,and guarantees pursuant hereto, whether express or implied. Fortinet reserves the right to change, modify, transfer, or otherwise revise this publication without notice, and the most current version of the publication shall be applicable.